> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vybe.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on (SSO)

> Let your team sign in to Vybe through your identity provider with OIDC or SAML, and require SSO for your email domain

Single sign-on lets people sign in to Vybe with your company's identity provider, such as Okta, instead of Slack, Google or an email link. Your identity provider decides who can sign in with SSO, and you can require SSO for everyone with your company email domain.

Owners and Admins set up SSO themselves. Vybe support then verifies that your organization owns the email domain. To see which plans include SSO, check the [pricing page](https://www.vybe.build/pricing).

## Before you start

You need:

* The **Owner** or **Admin** role in Vybe.
* Admin access to your identity provider, so you can create an app there.
* The email domain your team signs in with, for example `acme.com`.

Vybe supports two protocols. Choose **OIDC (Recommended)** unless your identity provider only offers SAML.

## Add an OIDC provider

**1. Create an app in your identity provider**

Create an OpenID Connect web application. In Okta, go to **Applications → Create App Integration**, then choose **OIDC - OpenID Connect** and **Web Application**. Copy its client ID and client secret.

**2. Open SSO settings in Vybe**

Go to **Settings → Organization → General**. Under **Single Sign-On (SSO)**, click **Add SSO Provider**.

**3. Fill in the OIDC tab**

On **OIDC (Recommended)**, enter:

* **Email Domain**: your team's email domain, such as `acme.com`.
* **Issuer Domain**: your identity provider's issuer, such as `your-org.okta.com`. It must use HTTPS.
* **Client ID** and **Client Secret** from step 1.

**4. Register**

Click **Register Provider**. Vybe opens **SSO Provider Configuration**.

**5. Add the redirect URI to your identity provider**

Copy the **Redirect URI (Sign-in redirect URI in Okta)** and add it as a sign-in redirect URI in your identity provider's app.

Vybe asks your identity provider for the `openid`, `email` and `profile` scopes.

## Add a SAML provider

**1. Open SSO settings in Vybe**

Go to **Settings → Organization → General**. Under **Single Sign-On (SSO)**, click **Add SSO Provider**, then open the **SAML** tab.

**2. Enter your email domain**

Enter the **Email Domain**, such as `acme.com`.

**3. Create a SAML app in your identity provider**

Create a SAML app in your identity provider. Set it to send the user's email address as the NameID.

**4. Add your identity provider's details**

Paste your identity provider's **Metadata URL** and click the download button next to it to fill in the rest. Or enter the **IdP Issuer**, **SSO URL** and **Certificate** yourself.

**5. Register**

Click **Register Provider**. Vybe opens **SSO Provider Configuration**.

**6. Finish the SAML app**

Copy the **SP Entity ID (Audience URI)** and the **ACS URL (Single sign-on URL)** into your identity provider's SAML app.

Vybe rejects SAML responses signed with outdated algorithms such as SHA-1. Use SHA-256 or stronger in your identity provider.

> [!TIP]
>
> To see these values again later, click the provider's row in the **Single Sign-On (SSO)** table. The table lists each provider's **Provider ID**, **Domain** and **Protocol**.

## Verify your domain

SSO sign-in only works after Vybe has verified that your organization owns the email domain. Until then, the settings show "Verify your domain to finish enabling SSO. Contact us to complete domain verification."

To ask for verification, click your provider's row and choose **Contact us to verify**, or email [support@vybe.build](mailto:support@vybe.build?subject=SSO%20domain%20verification%20request) with the subject "SSO domain verification request". Include your organization and the domain. When it's done, the provider shows **Domain verified**.

## Signing in with SSO

1. On the login page, click **Continue with SSO**.
2. In **Sign in with SSO**, enter your work email and click **Continue**.
3. Vybe finds your identity provider from your email domain and sends you there to sign in.

The first time someone signs in with SSO, Vybe creates their account and adds them to your organization as a **Viewer**. Owners and Admins can then [change their role](https://docs.vybe.build/organization/members-and-roles.md#change-a-members-role).

## Require SSO

You can make SSO the only way to sign in for your email domain. The switch shows your domain, for example **Require SSO for @acme.com**. When it's on, "Users with @acme.com email addresses must use SSO to sign in". Slack, Google and email-link sign-in are refused for that domain. Email-link sign-in shows "SSO is required for your email domain. Please use SSO to sign in."

To turn it on, your organization needs exactly one SSO provider, and its domain must be verified. With more than one provider, you see "SSO enforcement requires exactly one provider. Remove additional providers to enable enforcement."

While SSO is required, you can't add or remove providers. Turn it off first ("Disable SSO enforcement before removing a provider").

## Remove a provider

Click the trash icon on the provider's row and confirm. People can no longer sign in with that provider. If SSO is required, turn that off first.

## Provisioning

Vybe doesn't support SCIM. Accounts are created the first time someone signs in with SSO, and Vybe doesn't sync users or groups from your identity provider. When someone leaves, also [remove them from your organization](https://docs.vybe.build/organization/members-and-roles.md#remove-a-member) in Vybe.

## Troubleshooting

> **Sign-in fails right after I enter my work email**
>
> Vybe looks up your provider from the email domain. Check that the **Email Domain** on your provider matches the domain in the email you typed, and that the provider shows **Domain verified**. SSO sign-in doesn't work until the domain is verified.

> **The provider says Domain not verified**
>
> Domain verification is done by Vybe support. Click **Contact us to verify** on the provider, or email [support@vybe.build](mailto:support@vybe.build?subject=SSO%20domain%20verification%20request).

> **I can't turn on Require SSO**
>
> The switch only appears when your organization has exactly one provider with a verified domain. Remove any extra providers, and make sure the domain is verified.

> **SAML sign-in fails after the identity provider screen**
>
> Check that the **ACS URL** and **SP Entity ID** in your identity provider match the values in **SSO Provider Configuration**, that NameID is the user's email address, and that responses are signed with SHA-256 or stronger.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.